A security vulnerability in the argo-workflows package allows user-controlled data in errors returned from MarshalJSON methods to break the contextual auto-escaping of the html/template package. This can enable injection of unexpected content into templates. The issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2024-24785. A fix is available in version 4.1.6-r1. The vulnerability has a medium severity with a CVSS score of 5.4.
A security vulnerability in the argo-workflows package affects the ParseAddressList function, which incorrectly handles comments (text within parentheses) within display names. This flaw is present in versions prior to 4.1.6-r1 and has been assigned a high severity rating with a CVSS score of 7.5. The issue has been fixed in version 4.1.6-r1.
A security vulnerability in argo-workflows affects versions prior to 4.1.6-r1. The issue occurs when verifying a certificate chain that contains a certificate with an unknown public key algorithm, which causes a certificate verification failure. This flaw impacts the integrity of the verification process but does not affect confidentiality or availability. The vulnerability has a medium severity rating with a CVSS score of 5.9. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2024-21538) affects the argo-workflows package due to an issue in versions of the cross-spawn package before version 6. The affected argo-workflows versions are prior to 4.0.15-r2 and 4.1.6-r1. This vulnerability does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A high-severity security vulnerability (CVE-2024-4068) affects the argo-workflows package due to the use of the NPM package 'braces' in versions prior to 3. This vulnerability impacts argo-workflows versions before 4.0.15-r2 and 4.1.6-r1. The flaw does not affect confidentiality or integrity but causes a significant availability impact. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A medium severity vulnerability (CVE-2024-4067) affects the argo-workflows package due to the use of the NPM package micromatch versions prior to 4.0.15-r2 and 4.1.6-r1. The flaw impacts availability but does not affect confidentiality or integrity. Fixed versions 4.0.15-r2 and 4.1.6-r1 are available.
A high-severity elevation of privilege vulnerability exists in Microsoft.TestPlatform.CLI affecting multiple versions starting from 17.2.0-preview-20220301-01 through various 17.x and 18.x releases. The vulnerability involves the VSTest artifact postprocessor consuming a forged executionComplete.json file from another local user, allowing execution of attacker-controlled output handling. This flaw affects Windows, Linux, and macOS platforms. Patched versions are available across affected servicing lines.
CVE-2026-116590 is a vulnerability affecting multiple versions of Kafka that use snappy-java, a Java port of Google's fast C++ compression library. The flaw has a CVSS score of 5.9 with an impact primarily on availability. Fixed versions are available for all affected releases.
CVE-2026-93451 is a medium severity vulnerability affecting multiple Kafka package versions that use snappy-java through version 1. The flaw does not impact confidentiality but can lead to integrity and availability issues. Fixed versions are available for all affected releases.
CVE-2026-108106 is a high-severity vulnerability affecting multiple versions of Kafka that use Xerial snappy-java before version 1. The vulnerability impacts availability without compromising confidentiality or integrity. Fixed versions are available for all affected Kafka releases.
CVE-2026-102554 is a high-severity vulnerability involving allocation of resources without limits or throttling during Java object deserialization in Google Guava versions 4, affecting multiple packages including wso2is. This flaw can lead to excessive resource consumption. Fixed versions are available for all affected releases.
A security vulnerability in Rundeck affects several components in Spring Security where security-sensitive values are compared using standard string equality. This flaw can lead to potential security issues due to improper comparison methods. The vulnerability has a CVSS score of 5.9, indicating a medium severity level. Fixed versions 6.3.0-r0 and 6.1.0-r4 address this issue.
A security vulnerability in Rundeck affects applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC mode. This causes encryption with AES/CBC to use a null (all-zero) initialization vector, weakening the encryption. The issue is fixed in versions 6.3.0-r0 and 6.1.0-r4.
A security vulnerability in Rundeck affects versions prior to 6.3.0-r0 and 6.1.0-r4. It involves an authentication bypass caused by a capture-replay attack vulnerability in Spring Security's DPoPProofJwtDecoderFactory cache. This flaw allows attackers to bypass authentication mechanisms. The issue has a high severity score of 7.4 and has been fixed in the specified versions.
A security vulnerability in Rundeck affects versions prior to 6.3.0-r0 and 6.1.0-r4. The issue involves the use of Spring Security's WebAuthn support, which may allow user verification bypass when a distributed HTTP session store is used. This vulnerability has a high severity rating with a CVSS score of 7.4.
A critical security vulnerability exists in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 due to Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registering an administrative credential and binding its listener to all network interfaces. This flaw allows unauthenticated remote attackers to gain administrative access. The vulnerability has a CVSS score of 9.1, indicating high severity. Fixed versions 6.3.0-r0 and 6.1.0-r4 address this issue.
A security vulnerability in Rundeck affects versions prior to 6.3.0-r0 and 6.1.0-r4. Applications that construct a Content-Disposition HTTP header using untrusted input, such as malicious file names, may be vulnerable to HTTP response splitting attacks. This vulnerability has a low severity rating and does not impact confidentiality or availability but can affect integrity. A patch is available in versions 6.3.0-r0 and 6.1.0-r4.
A security vulnerability in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 involves the use of Spring MVC's UrlFileNameViewController without a configured prefix, leading to an open redirect issue. This flaw allows attackers to redirect users to arbitrary external URLs. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity level. Fixed versions 6.3.0-r0 and 6.1.0-r4 address this issue.
A path traversal vulnerability exists in Rundeck applications using Spring Framework's FreeMarker integration. This occurs when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates via SpringTemplateLoader. The vulnerability affects versions prior to 6.3.0-r0 and 6.1.0-r4. It has a medium severity with a CVSS score of 4.3. A patch is available in versions 6.3.0-r0 and 6.1.0-r4.
A security vulnerability in Rundeck's UrlHandlerFilter can lead to an open redirect when it is configured with overly broad matching patterns. This flaw affects versions prior to 6.3.0-r0 and 6.1.0-r4. The vulnerability has a medium severity with a CVSS score of 6.1. A patch is available in versions 6.3.0-r0 and 6.1.0-r4 that addresses this issue.